---
id: 5457
title: "Stealing passwords from infosec Mastodon - without bypassing CSP"
source_domain: portswigger.net
source_url: "https://portswigger.net/research/stealing-passwords-from-infosec-mastodon-without-bypassing-csp"
published_at: "2022-11-16T11:49:00Z"
tags: ["credential-theft", "web-security", "xss", "html-injection", "sanitization", "mastodon"]
phying_url: "https://phying.com/item/5457"
lang: en
---

# Stealing passwords from infosec Mastodon - without bypassing CSP

## Summary

How an HTML injection in Infosec Mastodon's post filter enabled credential theft without bypassing CSP, abusing quirks in the platform's HTML handling such as title attributes and emoji substitution.

## Intelligence Metadata

- **Sources:** portswigger.net
- **Published:** 2022-11-16T11:49:00Z
- **Original:** https://portswigger.net/research/stealing-passwords-from-infosec-mastodon-without-bypassing-csp
- **Phying News:** https://phying.com/item/5457